Privacy Policy

Jugaadors ("we", "us", "our") is an original tabletop game studio headquartered in Mumbai, India, with commercial operations in the United States. We operate the website at www.jugaadors.com (the "Site") and any associated sub-domains, APIs, and email communications.

For purposes of applicable privacy law, Jugaadors is the data controller of personal information collected through this Site.

2.1 Information You Provide Directly

When you submit the waitlist or founding list form on our Site, we collect:

We do not collect payment information, government-issued IDs, physical addresses, or any sensitive personal data through the Site.

2.2 Information Collected Automatically

When you visit our Site, we automatically collect:

Google Analytics 4 anonymises IP addresses by default before any geographic data is stored. We do not use GA4's advertising features or cross-site tracking.

2.3 Spam & Bot Protection Data

Our waitlist submission form uses server-side spam protections. We process:

• A honeypot field (hidden from real users — only bots fill it)
• Form submission timestamp (to detect bot-speed submissions)
• Your IP address in-memory during the request (3 submissions / 60 seconds rate limit — not stored after the request ends)
• Email domain (checked against a list of known disposable email providers)

No spam-protection data is persisted to a database.

We do not use session recording tools (e.g. Hotjar), heatmaps, ad pixels (Facebook Pixel, Google Ads tags), or any third-party tracking beyond GA4.

We process personal data only where we have a lawful basis to do so. The bases we rely on are:

For users in the European Economic Area (EEA) and United Kingdom, this processing is governed by Articles 6(1)(a) (consent) and 6(1)(f) (legitimate interests) of the GDPR / UK GDPR. For users in India, processing is governed by the Digital Personal Data Protection Act, 2023 (DPDPA) and, where applicable, the IT Act 2000 and SPDI Rules 2011.

We use the information we collect strictly for the following purposes:

We use a limited number of trusted third-party service providers. Each receives only the data necessary to perform their function.

We do not share your personal data with any other third parties. We do not sell, rent, or trade your data.

Sub-processors of sub-processors: Each of the above providers may use their own sub-processors; we direct you to their respective privacy policies for details on their data chains.

Our Site uses cookies placed by Google Analytics 4. We do not set any first-party cookies ourselves.

Managing cookies

You can control and delete cookies through your browser settings. Disabling GA4 cookies does not affect your ability to use any feature of the Site — the waitlist form, page content, and all interactive elements function without cookies. You can also opt out of Google Analytics tracking across all websites by installing the Google Analytics Opt-out Browser Add-on.

We do not use advertising cookies, social media pixels, fingerprinting, or any cross-site tracking technologies.

When retention periods expire or you exercise a deletion right, we will delete or irreversibly anonymise your personal data within 30 days, except where we are required to retain it by applicable law.

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• TLS/HTTPS — all data in transit between your browser and our Site is encrypted via HTTPS. Our hosting (Vercel) enforces HTTPS on all routes.
• Server-side submission handling — form data is not exposed client-side; it is processed via a private serverless function endpoint.
• Rate limiting — our API limits submissions to 3 per IP per 60 seconds to prevent mass enumeration and abuse.
• Spam & bot filters — honeypot fields, timing analysis, and disposable-domain blocking reduce inauthentic submissions.
• Access control — Google Sheets and Brevo data are accessible only to authorised team members under individual account credentials.
• No unnecessary data — we collect only what we need and do not store IP addresses, payment data, or sensitive personal information.

No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within the timeframes required by applicable law.

Jugaadors is based in India. Our service providers (Vercel, Google, Brevo) operate globally and may process your data in countries outside of India, including the United States and the European Union.

When your data is transferred outside India, we rely on the following safeguards as applicable under the DPDPA 2023:

• Vercel and Google are certified under data protection frameworks and operate under standard contractual clauses (SCCs) for EU data transfers where applicable.
• Brevo (Sendinblue) is an EU-based company compliant with GDPR and processes data under its Data Processing Agreement (DPA).

For EEA/UK users: transfers to the US are made under Standard Contractual Clauses (SCCs) approved by the European Commission or the UK ICO, as applicable, per each provider's data transfer mechanisms. You may request copies of applicable transfer mechanisms by contacting us.

Depending on where you are located, you have the following rights over your personal data. We honour all rights requests regardless of jurisdiction.

How to exercise your rights

Email us at jugaadors@gmail.com with the subject line "Privacy Request". Include your name (if provided) and email address so we can locate your record. We will respond within 30 days. We do not charge a fee for exercising your rights unless requests are manifestly unfounded or excessive.

Unsubscribing from email

Every marketing email we send contains an unsubscribe link. Clicking it removes you from all marketing communications immediately. Alternatively, email jugaadors@gmail.com with the subject "Unsubscribe".

Jurisdiction-specific rights

California residents (CCPA): We do not sell personal information. We do not share personal information for cross-context behavioural advertising. You have the right to know, delete, and opt-out. To exercise these rights, contact us at jugaadors@gmail.com.

Our Site is not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal data from anyone under these ages.

Our games are designed for adults and social gatherings of adults. The waitlist and founding-member programme is intended for adults aged 18 and above.

If you are a parent or guardian and believe your child has submitted personal data to us, please contact us at jugaadors@gmail.com and we will delete the information promptly.

Our Site contains links to third-party websites and platforms including LinkedIn, Facebook, Amazon, and others. Once you leave our Site, this Privacy Policy no longer applies. We have no control over and assume no responsibility for the privacy practices or content of third-party sites.

We encourage you to review the privacy policies of any external sites you visit. Links to third-party sites are provided for convenience and do not signify our endorsement of those sites or their privacy practices.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational, legal, or regulatory reasons.

When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify waitlist subscribers by email where required by law or where the changes materially affect how we process their data

We encourage you to review this page periodically. Your continued use of the Site after changes are posted constitutes your acknowledgement of the updated policy. Where applicable law requires renewed consent, we will seek it before continuing to process your data under the new terms.

Previous versions of this policy are available on request by emailing jugaadors@gmail.com.

For any privacy-related questions, requests, or concerns — including exercising any of your rights under applicable law — please contact us:

We take privacy seriously. Every request is reviewed by a human and handled with care. We do not use automated decision-making or profiling.